According to its Google’s ReCaptcha 3 blog post this service “runs adaptive risk analysis in the background to alert you of suspicious traffic while letting your human users enjoy a frictionless experience on your site”
Eff coverage outlines how this benefits Google:
ReCAPTCHA scripts don’t send raw interaction data back to Google. Rather, they generate something akin to a behavioural fingerprint, which summarizes the way a user has interacted with a page. Google feeds this into a machine-learning model to estimate how likely the user is to be human, then returns that score to the first-party website.
In addition to making things more convenient for users, this newer system benefits Google in two ways.
-
it makes CAPTCHAS invisible to most users, which may make them less aware that Google (or anyone) is collecting data about them.
-
it leverages Google’s huge set of behavioural data to cement its dominance in the CAPTCHA market, and ensures that any future competitors will need their own tranches of interaction data in order to build tools that work in a similar way.
In version 3, users are no longer clicking on school buses and crosswalks but rather the google script silently observes our regular page interactions in the background, making a determination of the user (or bot) based on behaviour fed into algorithms derived from machine learning. That is a scary aspect of it, we don’t know when we are being observed.